JP2000032049A - Gateway device, and computer readable recording medium recorded with multi-cast packet relay program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To relay a multi-cast packet securely. SOLUTION: Distribution scheduled information 2a sent from a 1st network 2 is given to an information analysis means 1d via a reception means 1a, and its contents are analyzed. As a result, reception medium information 1g is generated. Then contents of packet filter rule information 1ca are updated so that a relay permission information registration means 1e relays a multi-cast packet 2b with a destination indicated by the reception medium information 1g. Furthermore, the contents of packet filter rule information 1ca are updated so that a relay permission information cancellation means if does not relay the multi- cast packet 2b whose delivery period is expired. When the packet received by the reception means 1a is the multi-cast packet 2b whose relay is permitted by the packet filter rule information 1ca, a filtering means 1c permits the relay of packet and a transmission means 1b outputs the packet to a 2nd network 3.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a gateway device for relaying packets on a computer network and a computer-readable recording medium on which a multicast packet relay program is recorded, and more particularly to a method for relaying multicast packets relatively safely on the Internet. The present invention relates to a computer-readable recording medium recording a gateway device and a multicast packet relay program.

[0002]

2. Description of the Related Art Conventionally, an in-house LAN (Local Area Network) has been used.
k) A gateway device called a firewall as a means of protecting a WAN (Wide Area Network) from an Internet intruder / interferer such as a cracker (the “gateway device” here is a device that serves as a gate of a certain network) Meaning) is used. The firewall is installed between a company LAN and the Internet, and allows only a specific packet to pass through by identifying an IP (Internet Protocol) address. By providing communication restrictions on the firewall, the LAN / WAN in the organization can be kept safe. For example, the operating system of the platform of the gateway host (hereinafter referred to as OS
If a UNIX-based OS is used, ipfilt
By adding a packet filter mechanism such as er (UNIX software for filtering released at "http://coombs.anu.edu.au/ipfilter/"), it can function as a firewall. it can.

[0003] Conventional communication on the Internet is mainly one-to-one communication called unicast, but recently, one-to-many communication called multicast has been performed. It should be noted that since multicasting involves copying of packets, it is necessary to minimize the copying of packets. Therefore, when relaying a multicast packet, the necessity of relaying is dynamically set according to the presence or absence of a destination receiving host. This mechanism is realized in the UNIX OS by the fact that a program called mrouted resides as a background process.

[0004]

However, the function of the conventional firewall is based on unicast, and cannot be applied to multicast which has recently become available on the Internet (“Internet security with firewall construction”). . Brent Chapman, E
Co-authored by lizabeth D. Zwicky, translated by Kazumasa Udaishiro and translated by Katsuhiko Suzuki, O'Reilly Japan ISBN4-900900-03-6).

[0005] That is, in an actual application, an application for data transfer is specified by information called a port number. In a multicast relay process, relay is performed only by information of an address. Therefore, when a conventional gateway device relays a multicast packet, a packet having the same address but a different port number is also relayed. This means that when a packet with a port number not used by the application that should be used originally arrives, it may be passed to an unrelated application. If such a packet is allowed to be relayed, an external attack on another application becomes possible, which is not safe.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and has as its object to provide a gateway device that can safely relay multicast packets. Another object of the present invention is to provide a computer-readable recording medium on which a multicast packet relay program for causing a computer to relay a multicast packet safely is recorded.

[0007]

According to the present invention, in order to solve the above-mentioned problems, in a gateway device for relaying a multicast packet, distribution schedule information indicating a period during which the multicast packet is distributed and the multicast packet are provided. Receiving means for receiving from the first network, and packet filter rule information in which conditions for relaying the multicast packet are registered, and relaying of the multicast packet received by the packet receiving means is performed by the packet A filtering unit that determines whether or not the filtering is permitted in the filter rule information; a packet transmitting unit that transmits the multicast packet determined to be relayed by the filtering unit to a second network; packet Based on the distribution schedule information received by the communication unit, the receiving packet information including a destination address of the multicast packet and an identifier of an application program as a destination, and distribution period information indicating a distribution period. Information generating means for generating; and relay permission information registering means for updating the contents of the packet filter rule information so that the multicast packet matching the destination information of the received packet information generated by the information analyzing means is relayed. Relay permission information canceling means for updating the contents of the packet filter rule information so that the multicast packet whose delivery period indicated by the received packet information generated by the information analyzing means has not been relayed is relayed. Is provided.

According to such a gateway device, when the distribution schedule information is sent from the first network,
The contents are analyzed by the information analysis means, and received media information is generated. Then, the content of the packet filter rule information is updated by the relay permission information registration means so that the packet matching the destination information of the received media information is relayed. Further, the content of the packet filter rule information is updated by the relay permission information canceling unit so that the multicast packet whose distribution period has passed is not relayed.
When the multicast packet is distributed from the first network, the multicast packet is received by the receiving unit, and the filtering unit determines whether or not to permit the relay. Here, if the packet is a multicast packet permitted by the packet filter rule information, the packet is transmitted to the second network by the transmission unit. On the other hand, if the multicast packet is not permitted by the packet filter rule information, the packet is not relayed.

According to another aspect of the present invention, there is provided a computer-readable recording medium storing a multicast packet relay program for relaying a multicast packet, the distribution schedule information indicating a period during which the multicast packet is distributed. Receiving means for receiving the multicast packet from a first network, packet filter rule information in which conditions for relaying the multicast packet are registered, and the multicast packet received by the packet receiving means. Filtering means for determining whether or not relaying is permitted in the packet filter rule information, the multicast packet determined to be relayed by the filtering means,
Packet transmitting means for transmitting on a second network, a destination address of the multicast packet based on the distribution schedule information received by the packet receiving means,
Information analyzing means for generating receiving information including destination information including a pair with an identifier of an application program serving as a destination and distribution period information indicating a distribution period; and destination information of the receiving packet information generated by the information analyzing means. Relay permission information registering means for updating the contents of the packet filter rule information so that the matching multicast packet is relayed, and the multicast whose distribution period indicated by the received packet information generated by the information analyzing means has passed. A computer-readable recording medium having a multicast packet relay program recorded thereon, wherein the computer functions as relay permission information canceling means for updating the contents of the packet filter rule information so that packets are not relayed. .

When the computer executes the multicast packet relay program recorded on such a recording medium, the functions of the gateway device according to the present invention are realized by the computer.

[0011]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram illustrating the principle of the present invention. The gateway device 1 of the present invention is provided between a first network 2 and a second network 3.
In the first network 2, the multicast packet 2
b, and the distribution schedule information 2a indicating the period for distributing each multicast packet is distributed. The gateway device 1 relays a multicast packet from the first network 2 to the second network 3, and includes the following elements.

The receiving means 1a receives the distribution schedule information 2a and the multicast packet 2b sent from the first network 2. The transmitting unit 1b transmits the multicast packet 2b permitted to be relayed by the filtering unit 1c to the second network 3. The filtering means 1c includes the packet filter rule information 1
ca. In the packet filter rule information 1ca, a set of a destination address of a packet that may be relayed and an identifier (port number) of an application is set. Then, the filtering unit 1c determines whether to relay the multicast packet 2b received by the receiving unit 1a based on the packet filter rule information. That is, when a pair of the destination address of the multicast packet 2b received by the receiving unit 1a and the identifier of the application that should receive the distribution packet is registered in the packet filter rule information, the relay of the multicast packet 2b is permitted. .

The information analyzing means 1d analyzes the contents of the distribution schedule information 2a received by the receiving means 1a, and generates reception media information 1g for each medium to be distributed. The reception media information 1g includes a set (destination information) of a destination address, a destination application identifier (port number),
And distribution period information indicating a distribution period. The relay permission information registration unit 1e specifies destination information of a relayable medium based on the received media information, and sets the packet filter rule information 1 so that a packet of the medium is relayed.
Update the contents of ca. The relay permission information canceling means 1f includes:
Based on the received media information 1g, the media whose distribution scheduled period has elapsed is specified, and the contents of the packet filter rule information 1ca are updated so that the relay of the packet of the media whose distribution period has passed is rejected.

According to such a gateway device 1,
When the distribution schedule information 2a is sent from the first network 2, the receiving means 1a receives it. Receiving means 1a
Is delivered to the information analysis means 1d. Next, the content of the distribution schedule information 2a is analyzed by the information analysis means 1d, and the reception media information 1g is generated. The generated reception media information 1g is sent to the relay permission information registration unit 1e and the relay permission information cancellation unit 1f.
Then, the multicast packet 2 of the destination indicated in the reception media information 1g is registered by the relay permission information registration unit 1e.
b, so that packet filter rule information 1
The content of ca is updated. The contents of the packet filter rule information 1ca are updated by the relay permission information canceling unit 1f so that the multicast packet 2b whose distribution period has passed is not relayed.

When the multicast packet 2b is distributed from the first network 2, the multicast packet 2b is received by the receiving means 1a. At this time, if the multicast packet 2b is permitted by the packet filter rule information 1ca, the relay is permitted by the filtering means 1c. When the relay is permitted, the transmission means 1b transmits the multicast packet 2b on the second network 3. Thus, a client device connected to the second network 3 and capable of receiving information matching the destination information of the multicast packet 2b can receive the multicast packet 2b.

As described above, by relaying only the multicast packet 2b of the destination indicated by the distribution schedule information 2a, only the minimum necessary multicast packet can be transmitted onto the second network 3, and the multicast packet can be transmitted. Can be passed without affecting other applications or servers. As a result, while relaying the multicast packet 2b, the second
Unauthorized access from the first network 2 to the third network 3 can be eliminated.

Here, SDP (Session Description Protocol) is used as a protocol for exchanging multicast address / port information on a network such as the Internet.
l). In this protocol, information such as a sender, a transmission address, a port, a start time, and an end time of a session to be used are regularly transmitted in a multicast packet. Then, this SDP can be used as delivery of the distribution schedule information of the present invention. That is, if the protocol and the packet of the used address / port set announced by the protocol are allowed to pass only during the usage time and not the other, the possibility of attack / intrusion is reduced. Can be significantly reduced. Therefore, an embodiment in which the gateway device of the present invention is realized using SDP will be described below.

FIG. 2 is a conceptual diagram of a network to which the present invention is applied. The gateway device 100 of the present invention is connected to a server device 10 that provides various information via the Internet 11 and has a plurality of client devices 22 to 24 via an internal segment 21 of the LAN.
It is connected to the. The client devices 22 to 24 are computers to be protected from other computers on the Internet 11.

FIG. 3 is a diagram showing the internal configuration of the gateway device. As shown in the figure, the gateway device 100
Are two network interfaces 111 and 112
have. One network interface 11
1 is connected to the Internet 11, and the other network interface 112 is connected to the internal segment 21 of the LAN.

An operating system (OS) for controlling the entire device is provided inside the gateway device 100.
120 have been introduced. In this example, UNIX O
S shall be used. Network interface 1
The input / output data (packet) with the OS 11 and 112 is
120 sorts appropriately. To distribute the packet, the packet transmitting / receiving units 131 and 132 and the filtering processing unit 1
The functions with the function 40 are used.

The packet transmission / reception units 131 and 132 pass the packets received via the network interfaces 111 and 112 to the OS 120. Further, it transmits the packet received from the OS 120 to another computer via the network interfaces 111 and 112.
The presence of the packet transmission / reception units 131 and 132 enables the relay of a multicast packet. This function is included as a basic configuration of a UNIX-based OS. Multicast causes packet duplication, but in order to minimize duplication of the packet, mrou
By making the ted program resident as a background process, the necessity of relaying can be dynamically set depending on whether or not there is a client who wants to receive the program. That is, if there is no client device that desires to receive the multicast packet among the computers connected to the internal segment 21, even if the packet is permitted to be relayed, the packet is output onto the internal segment 21. It will not be done.

The filtering processing unit 140 determines whether the packets received by the packet transmitting / receiving units 131 and 132 may be relayed. More specifically, a list of address / port pairs of packets that can be relayed is held as packet filter rule information, and only packets registered in the packet filter rule information are allowed to be relayed. This packet filtering function is, for example, UNI
This can be achieved by incorporating an ipfilter into an X-based OS.

The contents of the packet filter rule information are rewritten by the multicast packet relay control unit 150. Multicast packet relay control unit 150
Performs the content update processing of the packet filter rule information related to the multicast packet.
51, a relay permission information registration unit 152, and a relay permission information cancellation unit 153. The information collection unit 151 uses the SDP
Is analyzed, and information on a set of a used address and a port is collected. Then, reception media information is generated. The relay permission information registration unit 152 sets whether or not to relay the packet filter rule information in units of a set of an address and a port based on the received media information. The relay permission information canceling unit 153 detects information on a set of an unused address and port based on the received media information, and outputs information on the corresponding multicast packet.
Delete from packet filter rule information. Note that the multicast packet relay control unit 150 actually
It is provided as one program and resides in the gateway device as a single background process.

The relay processing of the multicast packet in such a system will be described below. FIG. 4 is a flowchart showing the procedure of relaying a multicast packet. The following flowchart will be described along the step numbers. [S1] The multicast packet relay control unit 150
First, analyze the arguments. The arguments include specification of an interface to be controlled and specification of an output method of log information. [S2] The multicast packet relay control unit 150
Initialize signal processing. More specifically, the signal processing routine is set so as to perform processing for returning to the initial state when the program ends. [S3] The multicast packet relay control unit 150
Bring your own process to the background. That is,
Fork one's own self (a process of generating a copy of oneself as a child process), the child process continues execution, and the parent process ends and returns control. By setting the background, the process can be operated stably. [S4] The multicast packet relay control unit 150
Prepare to receive SDP address / port. To be more specific, sock is used for the address / port where the SDP information flows.
Perform et / bind (process to join the group for acquiring multicast packets). [S5] The multicast packet relay control unit 150
Wait for input. Specifically, a timeout (30 in this case)
(Seconds) and select (processing to specify the operation at the time of timeout), and put the program into sleep (processing to delay the command until the specified time) until there is an input to the SDP address / port. [S6] The multicast packet relay control unit 150
It is determined whether or not an input has been made. If there is an input, the process proceeds to step S7, and if not, the process proceeds to step S8. [S7] If there is an input, the information collecting unit 151 reads the information of the SDP and analyzes the information. When the SDP header is removed, each piece of used media information is described in SAP (Session Announcement Protocol) as shown in the following figure, so that the media information is analyzed.

FIG. 5 is a diagram showing an example of the SAP information.
“V” in the SAP information 30 indicates a version.
"O" means "origin", and information on a caller is set. “Mmaeda” is the identifier of the sender.
“3102815875” is the start time, and “3102815901” is the end time. The time notation is in NTP (Network Tim
e Protocol). “IN IP4” indicates version 4 of the Internet. `` 202.221.
74.12 "is the IP address. “S” is a title. “I” is an additional matter. “P” indicates the creator. “E” is the mail address of the creator.
“T” indicates a distribution start time and a distribution end time of information. “A” is various information related to a tool for receiving information. “M” is information about the media to be distributed, and includes the media type (audio) and port number (205).
94) The protocol (RTP / AVP 0) is set.
“C” is a group address (239.1) for receiving information.
33.82.90) is registered.

As a result of analyzing the SAP, only necessary information is extracted and stored in the array of the internal representation structure of the received media information. FIG. 6 is a diagram illustrating an example of the internal representation structure of the received media information. Internal representation structure 40
Defines the following information. "Struct in
“_Addr srcaddr;” defines the source address. In “struct in_addr addr;”, the address of the destination group is defined. "U_short port;"
The port number of the application program used is defined. "Time_tstime, etime, ltime;"
A start time, an end time, and a lifetime of information distribution are set. The start time is the start time of the program, and the end time is the end time of the program. The lifetime is the maximum waiting time when session information has not flowed for a certain period of time. If the next SDP does not flow from the time when the SDP is received until the time set by the lifetime elapses, it is recognized that the distribution of the program has ended. "In
“t filtered;” is information on whether or not the information has been registered.

The structure of such an internal representation is accommodated for each piece of information to be distributed. At this time, if the information has already been received, the lifetime of the information is extended. This is used to delete received media information that is considered to be obsolete and rules defined based on the received media information.

The description returns to FIG. [S8] The relay permission information registration unit 152 adds a passage rule. Specifically, when the time passes from the start to the end of the session, the passing rule of the address and port corresponding to the used media information is set to the filtering processing unit 140
Set in the packet filter root information. When the setting of the rule is completed, the already-set flag is set in the reception media information on the media. [S9] The relay permission information canceling unit 153 deletes unnecessary rules and organizes information. More specifically, the reception media information whose distribution end time has passed and the rule of the reception media information which has been deemed unnecessary since a certain period (lifetime) has passed since the SAP has not arrived are deleted from the packet filter rule information. Upon completion of the process in the step S9, the process returns to the step S5.

Hereinafter, detailed procedures of steps S7, S8, and S9 will be described. FIG. 7 is a flowchart of the SDP information reading / analyzing process. This is all processing performed by the information collection unit 151. [S11] The contents of the packet are copied to the read buffer. [S12] The SDP header is analyzed. [S13] The protocol and version are confirmed. SDP
If the protocol versions do not match, the process ends. Further, a flag indicating whether the information is new information or deletion information is extracted. [S14] The SDP header is skipped, and the SAP portion is extracted. Then, first, the first row of the SAP is selected, and the following processing is performed. [S15] If the selected row is the “o (Origin)” row, the following processing is performed. That is, if the network type is "IN"
If the protocol type is "IP4", the source address is registered as the session source address in the received media information. After that, the modification information of the reception media information is modified only when this address matches. [S16] If the selected line is the “c (Connection)” line, the following processing is performed. That is, if the network type is "IN" and the protocol type is "IP4", the destination address of this line is set in the reception media information. At this time, if the SDP type is new information, it is newly registered, but if it is deletion information, it is deleted. [S17] If the selected row is the “m (Media)” row, the following processing is performed. That is, the port number of the application required to use the media is read and registered in the received media information. [S18] If the selected line is the "t (Time)" line, the start time and end time information is read. At this time, the data is converted into an internal format in order to speed up the subsequent processing. [S19] It is determined whether the generation of the first received media information has been completed. If completed, the process proceeds to step S20, and if not completed, the process proceeds to step S15. [S20] It is determined whether or not unprocessed rows remain, and if so, the next row is selected and the process proceeds to step S21. If not, the process ends. [S21] If the selected row is the "c (Connection)" row, the following processing is performed as new received media information.
That is, if the network type is “IN” and the protocol type is “IP4”, the destination address is set in the received media information. At this time, if the SDP type is new information, it is registered, and if it is deletion information, it is deleted. Note that the session source address of the newly defined reception media information, and the start time and end time information are described in step S15 and step S15.
Set the same value as the value obtained in step 18. [S22] If the selected row is the “m (Media)” row, the following processing is performed. That is, the port number of the application required to use the medium is read and registered in the reception medium information defined in step S21. When this process ends, the process proceeds to a step S20.

FIG. 8 is a flowchart of a passage rule addition processing routine. This process is all performed by the relay permission information registration unit 152. [S31] One unprocessed received media information is selected. [S32] A rule for relaying the selected received media information is created. Specifically, the ioctl
(System call for controlling I / O). [S33] The selected receiving media information is not registered,
If the current time is later than the start time, the ioctl system call is used to store the packet filter rule information in the packet filter rule information of the filtering processing unit 140 in step S32.
Register the rule created in. [S34] It is determined whether or not there is unprocessed received media information. If there is unprocessed received media information, the process proceeds to step S31. If all the received media information has been processed, the process is terminated. finish.

FIG. 9 is a flowchart of an unnecessary rule deletion / information arrangement routine. This is a process performed by the relay permission information canceling unit 153. [S41] One unprocessed received media information is selected. [S42] It is determined whether the selected receiving medium has been registered. If registered, the process proceeds to step S43, and if not registered, the process proceeds to step S46. [S43] It is determined whether the time is outside the information distribution time, that is, whether the current time is later than the lifetime or the end time. If it is outside the distribution time, the process proceeds to step S44, and if it is within the time, the process proceeds to step S46. [S44] A rule is created. Specifically, reset the internal representation to a structure for ioctl. [S45] The rule corresponding to the rule created in step S44 is deleted from the packet filter rule information of the filtering processing unit 140. In particular,
Delete the corresponding rule from the kernel using the ioctl system call. [S46] It is determined whether there is an unprocessed reception medium. If there is an unprocessed reception medium, the process proceeds to step S41; otherwise, the process ends.

By setting the packet filter rules as described above, only the packets for which information distribution is scheduled are relayed by the gateway device. here,
For the actual operation, the following initial packet filter rule information is set.

FIG. 10 is a diagram showing an example of initial packet filter rule information. In the initial packet filter rule information 50, the multicast address area (“224.0.0.0” to “239.255.255.255”)
") Is basically blocking. Then, the port (UDP (U
ser Datagram Protocol) port 9875).

In this state, the SA shown in FIG.
When the P information arrives, the following rules are added in addition to FIG. FIG. 11 is a diagram illustrating packet filter rules to be additionally registered. The first line of the rule 51 added in this example is a packet whose transport layer protocol is UDP, whose destination address is “239.133.82.90”, and whose port number is larger than “20593” and smaller than “20596”. It is specified to pass. Also, 2
In the line, the transport layer protocol is UDP, the destination address is "239.133.109.125", and the port number is specified to pass packets larger than "49231" and smaller than "49234". In this case, the port specification is not a single port but a range. In fact, RTCP (Realtime Transport Control) is used as return information.
Protocol).
This rule is registered after the start time and deleted after the end time. Further, even if a certain period of time (life time) has passed after the SAP information has stopped coming, it is deleted.

As described above, by sequentially updating the contents of the packet filter rule information, only the packet of the address / port pair used for the distribution is relayed while the multicast packet is being distributed. Become. As a result, only the necessary packets among the multicast packets that could not be passed by conventional firewalls or could only be passed by knowing the insecurity were passed without affecting other applications or servers Will be able to

As a result, the same information distribution as that of the Internet can be performed while maintaining the security of the multicast client inside the firewall. Note that the above processing functions can be realized by a computer. In this case, the processing content of the function that the gateway device should have is described in a program recorded on a computer-readable recording medium. And
By running this program on a computer,
The above processing is implemented by a computer. Examples of the computer-readable recording medium include a magnetic recording device and a semiconductor memory. When distributing to the market, CD-
The program is stored and distributed in a portable recording medium such as a ROM (Compact Disk Read Only Memory) or a floppy disk, or stored in a storage device of a computer connected via a network, and is stored in another computer through the network. You can also transfer. When the program is executed by the computer, the program is stored in a hard disk device or the like in the computer, and is loaded into the main memory and executed.

[0037]

As described above, in the gateway device of the present invention, since the multicast packet can be relayed only while the multicast packet is being distributed, only the necessary multicast packet affects other applications and servers. Can now be passed through as if it weren't. As a result, while ensuring the security of the devices connected to the second network, the multicast packets distributed on the first network are transmitted to the second network.
Devices on this network.

In a computer readable recording medium on which the multicast packet relay program of the present invention is recorded, the computer can execute the recorded multicast packet relay program so that the computer can execute the multicast packet relay program only while the multicast packet is being distributed. It is possible to cause a computer to perform processing that enables relaying.

[Brief description of the drawings]

FIG. 1 is a principle configuration diagram of the present invention.

FIG. 2 is a conceptual diagram of a network to which the present invention is applied.

FIG. 3 is a diagram showing an internal configuration of a gateway device.

FIG. 4 is a flowchart showing a multicast packet relay processing procedure.

FIG. 5 is a diagram showing an example of SAP information.

FIG. 6 is a diagram illustrating an example of an internal representation structure of received media information.

FIG. 7 is a flowchart of SDP information reading / analyzing processing.

FIG. 8 is a flowchart of a passage rule addition processing routine.

FIG. 9 is a flowchart of an unnecessary rule deletion / information arrangement routine.

FIG. 10 is a diagram illustrating an example of initial packet filter rule information.

FIG. 11 is a diagram illustrating a packet filter rule additionally registered.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Gateway apparatus 1a Receiving means 1b Transmission means 1c Filtering means 1ca Packet filter rule information 1d Information analysis means 1e Relay permission information registration means 1f Relay permission information cancellation means 1g Received media information 2 First network 2a Distribution schedule information 2b Multicast packet 3 Second network

Claims (3)

[Claims] 1. A gateway device for relaying a multicast packet, receiving means for receiving, from a first network, distribution schedule information indicating a period during which the multicast packet is distributed, and the multicast packet; Holds packet filter rule information in which conditions for relaying
Filtering means for determining whether or not relaying of the multicast packet received by the packet receiving means is permitted in the packet filter rule information; and filtering the multicast packet determined to be permitted to be relayed by the filtering means. Based on the distribution schedule information received by the packet receiving unit, a destination including a set of a destination address of the multicast packet and an identifier of an application program serving as a destination. Information, and information analysis means for generating reception packet information including distribution period information indicating a distribution period, so that the multicast packet matching the destination information of the reception packet information generated by the information analysis means is relayed. The packet Relay permission information registering means for updating the contents of the filter rule information; and contents of the packet filter rule information so that the multicast packet whose delivery period indicated by the received packet information generated by the information analyzing means has passed is not relayed. And a relay permission information canceling means for updating the information. 2. The information analysis means determines a validity period for the received packet information, and the relay permission information canceling means registers the received packet information when the validity period of the received packet information expires. The gateway device according to claim 1, wherein the content of the packet filter rule information is updated so that the multicast packet is not relayed. 3. A computer-readable recording medium on which a multicast packet relay program for relaying a multicast packet is recorded, comprising: distribution schedule information indicating a period in which the multicast packet is distributed; Receiving means for receiving from the first network, holding packet filter rule information in which conditions for relaying the multicast packet are registered;
Filtering means for determining whether or not relaying of the multicast packet received by the packet receiving means is permitted in the packet filter rule information; andthe multicast packet determined to be relayed by the filtering means. Packet transmitting means for transmitting on a second network, based on the distribution schedule information received by the packet receiving means, destination information comprising a set of a destination address of the multicast packet and an identifier of an application program as a destination, Information analyzing means for generating received packet information including distribution period information indicating a distribution period, and the packet filter so that the multicast packet matching the destination information of the received packet information generated by the information analyzing means is relayed. Relay permission information registering means for updating the contents of the rule information, the contents of the packet filter rule information being updated so that the multicast packet whose delivery period indicated by the received packet information generated by the information analyzing means has not passed is not relayed. A computer-readable recording medium on which a multicast packet relay program is recorded, wherein the computer functions as a relay permission information canceling means for updating.